Identify, quantify, and manage the risks to your company's reputation 
long before a problem or crisis strikes. 


REPUTATION 

and Its Risks 

by Robert G. Eccles, Scott C. Newquist, and Roland Schatz 


executives know the importance of their companies’ repu- 
tations. Firms with strong positive reputations attract better 
people. They are perceived as providing more value, which 
often allows them to charge a premium. Their customers are 
more loyal and buy broader ranges of products and services. 
Because the market believes that such companies will deliver 
sustained earnings and future growth, they have higher 
price-earnings multiples and market values and lower costs 
of capital. Moreover, in an economy where 70% to 80% of 
market value comes from hard-to-assess intangible assets 
such as brand equity, intellectual capital, and goodwill, orga- 
nizations are especially vulnerable to anything that damages 
their reputations. 


104 Harvard Business Review I February 2007 I hbr.org 



Reputation and Its Risks 


Most companies, however, do an inadequate job of man- 
aging their reputations in general and the risks to their rep- 
utations in particular. They tend to focus their energies on 
handling the threats to their reputations that have already 
surfaced. This is not risk management; it is crisis manage- 
ment - a reactive approach whose purpose is to limit the 
damage. This article provides a framework for proactively 
managing reputational risks. It explains the factors that af- 
fect the level of such risks and then explores how a company 
can sufficiently quantify and control them. Such a process 
will help managers do a better job of assessing existing and 
potential threats to their companies’ reputations and decid- 
ing whether to accept a given risk or to take actions to avoid 
or mitigate it. 

The Current State of Affairs 

Regulators, industry groups, consultants, and individual com- 
panies have developed elaborate guidelines over the years 
for assessing and managing risks in a wide range of areas, 
from commodity prices to control systems to supply chains 
to political instability to natural disasters. However, in the 


reputational risks. That’s mainly because of the difficulty of 
factoring them into capital-adequacy requirements, most 
banking-risk professionals would say. 

Given this lack of common standards, even sophisticated 
companies have only a fuzzy idea of how to manage reputa- 
tional risk. A large U.S. pharmaceutical company reflects the 
current state of practice among well-run organizations. It has 
an ERM system for managing operational and financial risks, 
as well as hazards from external events such as natural disas- 
ters, that is loosely based on the COSO framework. The firm’s 
vice president of risk management oversees the system. How- 
ever, the company manages reputational risks only infor- 
mally - and unevenly - at the local and product levels. Its 
leaders consider reputational risk only when they make 
major decisions such as those involving acquisitions. (The 
company’s due-diligence process includes the evaluation of 
problems that could affect reputation, including pending 
lawsuits, weak product-testing procedures, product-liability 
concerns, and poor control systems for detecting management 
fraud.) The risk management VP says that reputational risk 
is not included in the long list of risks for which he is respon- 
sible. Then who is responsible? The CEO, the vice president 


a 


It takes many good deeds to build a good reputation, 
and only one bad one to lose it. 

-Benjamin Franklin 


absence of agreement on how to define and measure reputa- 
tional risk, it has been ignored. 

Consider the 135-page framework for enterprise risk man- 
agement (ERM) proposed in 2004 by the Committee of 
Sponsoring Organizations of the Treadway Commission 
(COSO), a group of professional associations of U.S account- 
ants and financial executives that issues guidelines for inter- 
nal controls. Although the framework mentions virtually 
every other imaginable risk, it does not contain a single ref- 
erence to reputational risk. 

Nor does the Basel II international accord for regulating 
capital requirements for large international banks. In de- 
fining operational risk as “the risk of loss resulting from 
inadequate or failed internal processes, people and systems 
or from external events,” the Basel II framework, issued in 
2004 and updated in 2005, specifically excludes strategic and 


surmises, since that is who oversees the firm’s elaborate crisis- 
response system and is ultimately responsible for dealing 
with any events that could damage the company’s reputa- 
tion. This pharmaceutical firm is not alone. Contingency 
plans for crisis management are as close as most large and 
midsize companies come to reputational-risk management. 
While such plans are important, it is a mistake to confuse 
them with a capability for managing reputational risk. Know- 
ing first aid is not the same as protecting your health. 

Determinants of Reputational Risk 

Three things determine the extent to which a company is ex- 
posed to reputational risk. The first is whether its reputation 
exceeds its true character. The second is how much external 
beliefs and expectations change, which can widen or (less 
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BP's Sinking Image 


Media coverage plays a large role in determining 
a company's reputation. The changing mix of positive 
and negative stories mentioning BP in the leading 
British, German, and U.S. media from January 2003 
through September 2006 shows how a series of 
events hurt the oil giant's reputation. During 2003 
and 2004, the ratio of positive to negative stories 
was about two to one. However, stories about an ex- 


plosion at BP's Texas City refinery, alleged tax evasion 
in Russia, and job cuts in Europe took their toll in 
2005, when positive and negative coverage were 
roughly equal. Events in 2006-especially an oil leak 
at the Prudhoe Bay field in Alaska due to pipeline cor- 
rosion, and a subsequent cut in production -caused 
the number of stories mentioning BP to soar and the 
mix to become more negative than positive. 
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likely) narrow this gap. The third is the quality of internal co- 
ordination, which also can affect the gap. 

Reputation-reality gap. Effectively managing reputational 
risk begins with recognizing that reputation is a matter of per- 
ception. A company’s overall reputation is a function of its 
reputation among its various stakeholders (investors, cus- 
tomers, suppliers, employees, regulators, politicians, non- 
governmental organizations, the communities in which the 
firm operates) in specific categories (product quality, corpo- 
rate governance, employee relations, customer service, intel- 
lectual capital, financial performance, handling of environ- 
mental and social issues). A strong positive reputation among 
stakeholders across multiple categories will result in a strong 
positive reputation for the company overall. 


Reputation is distinct from the actual character or behav- 
ior of the company and may be better or worse. When the 
reputation of a company is more positive than its underlying 
reality, this gap poses a substantial risk. Eventually, the fail- 
ure of a firm to live up to its billing will be revealed, and its 
reputation will decline until it more closely matches the re- 
ality. BP appears to be learning this the hard way. The energy 
giant has striven to portray itself as a responsible corporation 
that cares about the environment. Its efforts have included 
its extensive “Beyond Petroleum” advertising campaign and 
a multibillion-dollar initiative to expand its alternative- 
energy business. But several major events in the past two 
years are now causing the public to question whether BP is 
truly so exceptional. (See the exhibit “BP’s Sinking Image.”) 
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One was the explosion and fire at its Texas City refinery in 
March 2005 that killed 15 people and injured scores of oth- 
ers. Another was the leak in a corroded pipeline at its Prud- 
hoe Bay oil field in Alaska that occurred a year later and 
forced the company to slash production in August 2006. BP 
has blamed the refinery disaster on lax operating practices, 
but federal investigators have alleged that cost cutting con- 
tributed as well. Employee allegations and company reports 
suggest that the root cause of the Prudhoe Bay problem may 
have been inadequate maintenance and inspection practices 
and management’s failure to heed warnings of potential cor- 
rosion problems. As media coverage reflects, these events and 
others have damaged BP’s reputation. 

To bridge reputation-reality gaps, a company must either 
improve its ability to meet expectations or reduce expecta- 
tions by promising less. The problem is, managers may resort 


Changing beliefs and expectations. The changing beliefs 
and expectations of stakeholders are another major deter- 
minant of reputational risk. When expectations are shifting 
and the company’s character stays the same, the reputation- 
reality gap widens and risks increase. 

There are numerous examples of once-acceptable prac- 
tices that stakeholders no longer consider to be satisfactory 
or ethical. Until the 1990s, hostile takeovers in Japan were al- 
most unheard of- but that was partly due to the cross-holding 
of shares among the elite groups of companies known as kei- 
retsu, a practice that undermined the power of other share- 
holders. With the weakening of the keiretsu structure during 
the past ten to 15 years, shareholder rights and takeovers 
have been on the rise. In the United States, once-acceptable 
practices now considered improper include brokerage firms 
using their research functions to sell investment-banking 


a Character is like 
is what we think 


a tree and reputation like its shadow. The shadow 
of it; the tree is the real thing. 


Abraham Lincoln 


to short-term manipulations. For example, reputation-reality 
gaps concerning financial performance often result in ac- 
counting fraud and (ultimately) restatements of results. Com- 
puter Associates, Enron, Rite Aid, Tyco, WorldCom, and 
Xerox are some of the well-known companies that have 
fallen into this trap in recent years. 

Of course, organizations that actually meet the expecta- 
tions of their various stakeholders may not get full credit for 
doing so. This often occurs when a company’s reputation has 
been significantly damaged by unfair attacks from special in- 
terest groups or inaccurate reporting by the media. It also 
can happen when a company has made genuine strides in ad- 
dressing a problem that has hurt its reputation but can’t con- 
vince stakeholders that its progress is real. For example, Chry- 
sler, Ford, and General Motors improved their cars so much 
that the quality gap between them and the vehicles made by 
Japanese companies had largely closed by 2001. Yet, much to 
the frustration of the Big Three, consumers remain skeptical. 

Undeserved poor or mediocre reputations can be mad- 
dening. The temptation is to respond to them with resigna- 
tion and conclude: “No matter what we do, people won’t like 
us, so why bother?” The reason executives should bother - 
through redoubled efforts to improve reporting and com- 
munications -is that their fiduciary obligation to close such 
reputation-reality gaps is as great as their obligation to im- 
prove real performance. Both things drive value creation for 
shareholders. 


deals; insurance underwriters’ incentive payments to bro- 
kers, which caused brokers to price and structure coverage to 
serve underwriters’ interests rather than customers’; the ap- 
pointment of CEOs’ friends to boards as “independent direc- 
tors”; earnings guidance; and smoothing of earnings. 

Sometimes norms evolve over time, as did the now wide- 
spread expectation in most developed countries that com- 
panies should pollute minimally (if at all). A change in the 
behavior or policies of a leading company can cause stake- 
holders’ expectations to shift quite rapidly, which can imperil 
the reputations of firms that adhere to old standards. For ex- 
ample, the “ecomagination” initiative launched by General 
Electric in 2005 has the potential to raise the bar for other 
companies. It committed GE to doubling its R&D investment 
in developing cleaner technologies, doubling the revenue 
from products and services that have significant and measur- 
able environmental benefits, and reducing GE’s own green- 
house emissions. 

Of course, different stakeholders’ expectations can diverge 
dramatically, which makes the task of determining accept- 
able norms especially difficult. When GlaxoSmithKline pio- 
neered the development of anti-retroviral drugs to combat 
AIDS, its reputation for conducting cutting-edge research 
and product development was reinforced and shareholders 
were pleased. They were initially on board when GSK led 
a group of pharmaceutical companies in suing the South 
African government after it passed legislation in 1997 allow- 
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mg the country to import less expensive, 
generic versions of AIDS drugs covered 
by GSK patents. But in 2001, GSK share- 
holders did an about-face in reaction to 
an intensifying campaign waged by NGOs 
and to the trial proceedings, which made 
GSK and the other drug companies look 
greedy and immoral. With its reputation 
plunging, GSK relented and granted a 
South African company a free license to 
manufacture generic versions of its AIDS 
drugs-but the damage was already done. 

Sometimes, particular events can 
cause latent concerns to burst to the sur- 
face. One example would be all the ques- 
tions about whether Merck had fully 
disclosed the potential of its painkiller 
Vioxx to cause heart attacks and strokes. 

Merck is embroiled in thousands of law- 
suits over the arthritis drug, which it 
pulled from the market in 2004. The con- 
troversy has raised patients’ and doctors’ 
expectations that drug companies should 
disclose more detailed results and analy- 
ses of clinical trials, as well as experience 
in the market after drugs have received 
regulatory approval. 

When such crises strike, companies 
complain that they have been found 
guilty (in the courts or in the press) be- 
cause the rules have changed. But all too often, it’s their own 
fault: They either ignored signs that stakeholders’ beliefs and 
expectations were changing or denied their validity. 

In addition, organizations sometimes underestimate how 
much attitudes can vary by region or country. For example, 
Monsanto, a developer of genetically modified plants, was 
badly burned by its failure to anticipate Europeans’ deep con- 
cerns about genetically modified foods. 

Weak internal coordination. Another major source of rep- 
utational risk is poor coordination of the decisions made by 
different business units and functions. If one group creates 
expectations that another group fails to meet, the company’s 
reputation can suffer. A classic example is the marketing de- 
partment of a software company that launches a large adver- 
tising campaign for a new product before developers have 
identified and ironed out all the bugs: The company is forced 
to choose between selling a flawed product and introducing 
it later than promised. 

The timing of unrelated decisions also can put a com- 
pany’s reputation at risk, especially if it causes a stakeholder 
group to jump to a negative conclusion. This happened to 
American Airlines in 2003, when it was trying to stave off 
bankruptcy. At the same time that it was negotiating a major 
reduction in wages with its unions, its board approved reten- 


tion bonuses for senior managers and a big payment to a 
trust fund designed to protect executive pensions in the 
event of bankruptcy. However, the company didn’t tell the 
unions. Furious when they found out, the unions revisited 
the concessions package they had approved. The controversy 
cost CEO Donald J. Carty his job. 

Poor internal coordination also inhibits a company’s abil- 
ity to identify changing beliefs and expectations. In virtually 
all well-run organizations, individual functional groups not 
only have their fingers on the pulses of various stakehold- 
ers but are also actively trying to manage their expectations. 
Investor Relations (with varying degrees of input from the 
CFO and the CEO) attempts to ascertain and influence the ex- 
pectations of analysts and investors; Marketing surveys cus- 
tomers; Advertising buys ads that shape expectations; HR 
surveys employees; Corporate Communications monitors 
the media and conveys the company’s messages; Corporate 
Social Responsibility engages with NGOs; and Corporate Af- 
fairs monitors new and pending laws and regulations. All of 
these actions are important to understanding and managing 
reputational risks. But more often than not, these groups do 
a bad job of sharing information or coordinating their plans. 

Coordination is often poor because the CEO has not as- 
signed this responsibility to a specific person. When 269 
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executives were asked in 2005 by the Economist Intelligence 
Unit who at their companies had “major responsibility” for 
managing reputational risk, 84% responded, “The CEO.” This 
means that nobody is really overseeing the coordination pro- 
cess. Yes, the CEO is the person ultimately responsible for 
reputational risk, since he or she is ultimately responsible 
for everything. But the fact of the matter is, the CEO does not 
have the time to manage the ongoing process of coordinat- 
ing all the activities that affect reputational risk. 

Managing Reputational Risk 

Effectively managing reputational risk involves five steps: as- 
sessing your company’s reputation among stakeholders, eval- 
uating your company’s real character, closing reputation- 
reality gaps, monitoring changing beliefs and expectations, 
and putting a senior executive below the CEO in charge. 

Assess reputation. Since reputation is perception, it is per- 
ception that must be measured. This argues for the assess- 
ment of reputation in multiple areas, in ways that are contex- 
tual, objective, and, if possible, quantitative. Three questions 
need to be addressed: What is the company’s reputation in 
each area (product quality, financial performance, and so 
on)? Why? How do these reputations compare with those of 
the firm’s peers? 

Various techniques exist for evaluating a company’s repu- 
tation. They include media analysis, surveys of stakeholders 
(customers, employees, investors, NGOs) and industry exec- 
utives, focus groups, and public opinion polls. Although all 
are useful, a detailed and structured analysis of what the 
media are saying is especially important because the media 
shape the perceptions and expectations of all stakeholders. 

Today, many companies hire clipping services to gather 
stories about them. Text- and speech-recognition technolo- 
gies enable these services to scan a wide range of outlets, in- 
cluding newspapers, magazines, TV, radio, and blogs. They 
can provide information on such things as the total number 
of stories, the number per topic, and the source and author 
of each story. While useful in offering a real-time sample of 
media coverage, these services are not always accurate in as- 
sessing whether a story about a company is positive, nega- 
tive, or neutral, because of the limits of the computer algo- 
rithms that they employ. They also tend to miss stories that 
cite a company but do not mention it in the headline or first 
few sentences. 

Therefore, the old tool of clipping services needs to be 
supplemented with strategic media intelligence. This new 
tool not only analyzes every line in a story but also places the 
coverage of a company within the context of all the stories in 
the leading media (those that set the tone for the coverage of 
topics, companies, and people in individual countries). Since 
the reputation of a company is a function of others’ reputa- 
tions in its industry and the relative reputation of the indus- 
try overall, having the complete context is essential for assess- 


ing volume and prominence of coverage, topics of interest, 
and whether the view is positive or negative. 

Establishing a positive reputation through the media de- 
pends on several factors or practices, according to research 
by the Media Tenor Institute for Media Analysis (founded by 
coauthor Roland Schatz) in Lugano, Switzerland. 

First, the company has to land and remain on the public’s 
radar screen, which involves staying above what we call the 
“awareness threshold”: a minimum number of stories men- 
tioning or featuring the company in the leading media. This 
volume, which must be continual, varies somewhat from 
company to company, depending on industry and country 
but not on company size. 

Second, a positive reputation requires that at least 20% of 
the stories in the leading media be positive, no more than 
10% negative, and the rest neutral. When coverage is above 
the awareness threshold and is positive overall, the com- 
pany’s reputation benefits from individual positive stories 
and is less susceptible to being damaged when negative sto- 
ries appear. If coverage is above the awareness threshold but 
the majority of stories are negative, a company will not ben- 
efit from individual positive stories, and bad news will rein- 
force its negative reputation. All companies -large or small - 
should care about staying above their awareness threshold. 
Even if a small company has a very strong reputation among 
a small group of core investors or customers, it runs a high risk 
of suffering considerable damage to its reputation if its media 
coverage is below the awareness threshold when a crisis hits. 

A company’s reputation is also vulnerable if the media are 
focused on just a few topics, such as earnings and the person- 
ality of the CEO. Even if the coverage of these topics is ex- 
tremely favorable, a negative event outside these areas will 
have a much larger negative impact than it would have if the 
firm had enjoyed broader positive coverage. 

Third, managers can influence the mix of positive, negative, 
and neutral stories by striving to optimize the company’s 
“share of voice”: the percentage of leading-media stories 
mentioning the firm that quote someone from the organiza- 
tion or cite data it has provided. Media Tenor’s research sug- 
gests that a company needs to have at least a 35% share of 
voice in order to keep the proportion of negative stories to a 
minimum in normal times. Strong relationships and credibil- 
ity with the press are crucial to attaining a large share of voice 
and are especially important during a crisis, when a company 
really needs to communicate its point of view. In such times, 
management’s share of voice needs to be at least 50% to en- 
sure that critics of the company don’t prevail. Merck’s travails 
after the problems with Vioxx illustrate the consequences of 
a company inadequately managing its position in the media. 
(See the exhibit “Merck: The Perils of a Low Profile.”) 

Evaluate reality. Next, the company must objectively eval- 
uate its ability to meet the performance expectations of 
stakeholders. Gauging the organization’s true character is 
difficult for three reasons: First, managers-business unit and 
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Merck: The Perils of a Low Profile 


Merck was ill prepared to defend its reputation when the Vioxx 
crisis hit. In the 33 months prior to Merck's withdrawal of the 
pain medication on September 30, 2004, the company had a low 
profile: There weren’t enough leading-media stories mentioning 
it to keep it above the public's "awareness threshold." Although 
27% of the stories were positive, they were neutralized by the 
28% that were negative. In addition, before the recall, a woefully 
inadequate 7% of stories quoted someone from the company or 


cited data provided by it, meaning Merck didn't have the "share 
of voice" required to communicate its positions. After the an- 
nouncement of Vioxx's withdrawal, the average number of sto- 
ries per month mentioning Merck more than tripled -but 60% of 
the stories that appeared through September 2006 were nega- 
tive and only 13% positive. It will be difficult for Merck to rebuild 
its reputation-especially since its share of voice has decreased 
to 5.5%. 
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functional heads as well as corporate executives-have a nat- 
ural tendency to overestimate their organizations’ and their 
own capabilities. Second, executives tend to believe that 
their company has a good reputation if there is no indication 
that it is bad, when in fact the company has no reputation 
in that area. Finally, expectations get managed: Sometimes 


they are set low in order to ensure that performance objec- 
tives will be achieved, and other times they are set optimisti- 
cally high in an attempt to impress superiors or the market. 

As is the case in assessing reputation, the more contextual, 
objective, and quantitative the approach to evaluating char- 
acter, the better. Just as the reputation of a company must 
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One Drug Company's Dashboard for Spotting Potential Risks 


A Europe-based pharmaceutical com- 
pany uses this dashboard to track vari- 
ances in performance that can lead to 
risky behavior. (The names of divisions 
and brands have been changed and the 
data have been scaled to protect propri- 
etary information.) Although the reve- 
nues of the company's U.S. business 


are ahead of plan, the Central Nervous 
System & Pain division is projecting that 
its revenues for the full year will fall short, 
mainly because of the Ibellance brand's 
projected performance. At this point, cor- 
porate executives should meet with the 
division's managers to ensure that none 
of the unit's planned actions to address 


the projected shortfall -such as special 
incentive programs for the sales force 
or prescribing physicians-would create 
unacceptable reputational risk for the 
company. And if Ibellance's performance 
dramatically improves during the rest of 
the year, they would be wise to investi- 
gate again. 


Variances from Budget on Revenue Projections, Year-to-Date 
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Digestive 

Division 

$46.1 7M 


Allergy & 
Respiratory 
Division 

$1 1 9.09M 


Inflammation 

Division 

$50.67M 


Central Nervous 
System & Pain 
Division 

-S73.23M 


Oncology 

Division 

$1 90.84M 


Other 

Pharmaceuticals 

$20.34M 


Other 

Businesses 

-S3.78M 


Deipand brand 

Prelfin brand 

Elmaxol brand 

Thivas brand 

Gaprivert brand 

$50.40M 

-$32.58M 

$30.67M 

$7.90M 

$154.45M 

Mangeium brand 

Transbis brand 

Osisequn brand 

Itrarig brand 

Lobane brand 

-$7.04M 

$93.38M 

-$5.43M 

— $1 5.09M 

$1 6.96M 


All other marketed Ectosyceium brand Throac brand Hispecart brand Oprav products 

digestive products $0M $1 6.64M — $1 2.97M -$0.01 M 

$2.81 M 


Prasess brand 

Aphervir brand 

Ibellance brand 

Smoodent brand 

$0M 

— $3.1 OM 

-S43.44M 

$1 3.92M 

Ectonab brand 

Othuctage brand 

Othedicize brand 

Grispec brand 

$62.81 M 

$1 5.1 9M 

-$3.74M 

$2.89M 


Brevdorp brand Oloxic brand All other marketed All other oncology 

-$1.88M $0M CNS & Pain products products 

-$5.89M $2.63M 



All other marketed All other marketed 
A&R products inflammation 

-$2.64M products 

-$3.3M 


Analysis conducted with Empower visualization 
software, by Metapraxis. 


On or close to budget 
(variance <5%) 


Below budget (variance >5%) 


112 Harvard Business Review I February 2007 I hbr.org 



be assessed relative to competitors, so must its reality. For 
example, performance-improvement targets based only on 
a company’s results for the previous year are meaningless if 
competitors are performing at a much higher level. The im- 
portance of benchmarking financial and stock performance 
and processes against peers’ and those of companies re- 
garded as “best in class” is hardly a revelation. However, the 
degree of sophistication and detail as well as the accuracy or 
reliability of benchmarking data can vary enormously. The 
reasons include transcription errors (a big problem when a 
large amount of data in paper documents has to be manually 
entered into electronic spreadsheets), for instance, and the 
inability to determine whether the way competitors report 
information in an area is consistent. One company might in- 
clude customers’ purchases of extended warranties in its rev- 
enues, while another might not. 

Some new tools should help address these issues. One of 
the most noteworthy is Extensible Business Reporting Lan- 
guage (XBRL). A version of the Internet standards technol- 
ogy Extensible Markup Language (XML), XBRL allows each 
piece of information in a financial statement to be electron- 
ically tagged so that it can be quickly and cheaply pulled into 
analytical software. These tags are contained in dictionaries, 
or “taxonomies,” based on sets of standards such as the U.S. 
generally accepted accounting principles. XBRL-formatted fi- 
nancial statements are already available from companies 
such as EDGAR Online, but these early offerings have limi- 
tations. Taxonomies for specific industries must be devel- 
oped; software for downloading and analyzing XBRL data is 
still at an early stage; and EDGAR Online’s offering includes 
European companies only if their shares are listed on a U.S. 
exchange (although an XBRL taxonomy does exist for inter- 
national financial reporting standards, used by all members 
of the European Union and a number of other countries). 
Christopher Cox, the chairman of the Securities and Ex- 
change Commission, is determined to address such limita- 
tions and accelerate the widespread adoption of XBRL. To- 
ward that end, he announced in September 2006 that the 
SEC will invest $54 million in an interactive data system 
based on XBRL, which “will represent a quantum leap over 
existing disclosure technologies.” (For more detail, see the 
HBR List item “Here Comes XBRL” in this issue.) 

Another valuable new tool for managing reputational risk 
is visualization software, which uses colors, shapes, and dia- 
grams to communicate the key points in financial and oper- 
ating data. These displays are a big improvement over the 
spreadsheets now widely used, which often make it difficult 
for even the most financially sophisticated executives to spot 
important anomalies and trends. Because it takes so much 
time to make sense of spreadsheets, executives tend to focus 
on the largest business units even though the greatest risks 
to reputation may reside in smaller ones-such as a struggling 
foreign subsidiary that has begun to employ questionable 
means to meet budget targets. (See the exhibit “One Drug 


Company’s Dashboard for Spotting Potential Risks” for an 
example of a simple but effective use of visualization soft- 
ware to highlight whether business units and products are on 
track to meet year-end goals.) 

Close gaps. When a company’s character exceeds its repu- 
tation, the gap can be closed with a more effective investor 
relations and corporate communications program that em- 
ploys the principles of strategic media intelligence discussed 
above. If a reputation is unjustifiably positive, the company 
must either improve its capabilities, behavior, and perfor- 
mance or moderate stakeholders’ perceptions. Of course, few 
companies would choose the latter if there were any way to 
accomplish the former. If, however, the gap is large, the time 
required to close it is long, and the damage if stakeholders 
recognize the reality is likely to be great, then management 
should seriously consider lowering expectations - although 
this obviously needs to be done in careful, measured ways. 

Monitor changing beliefs and expectations. Understand- 
ing exactly how beliefs and expectations are evolving is not 
easy, but there are ways to develop a picture over time. For 
instance, regular surveys of employees, customers, and other 
stakeholders can reveal whether their priorities are chang- 
ing. While most well-run companies conduct such surveys, 
few take the additional step of considering whether the data 
suggest that a gap between reputation and reality is materi- 
alizing or widening. Similarly, periodic surveys of experts in 
different fields can identify political, demographic, and social 
trends that could affect the reputation-reality gap. “Open re- 
sponse” questions can be used to elicit new issues of impor- 
tance-and thus new expectations-that other questions might 
miss. It is generally useful to supplement these surveys with 
focus groups and in-depth interviews to develop a deeper un- 
derstanding of the causes and possible consequences of trends. 

Influential NGOs that could make the company a target 
are one group of stakeholders that should be monitored. 
These include environmental activists; groups concerned 
about wages, working conditions, and labor practices; con- 
sumers’ rights groups; globalization foes; and animals’ rights 
groups. Many executives are skeptical about whether such 
organizations are genuinely interested in working collabora- 
tively with companies to achieve change for the public good. 
But NGOs are a fact of life and must be engaged. Interviews 
with them can also be a good way of identifying issues that 
may not yet have appeared on the company’s radar screen. 

Finally, companies need to understand how the media 
shape the public’s beliefs and expectations. Dramatic changes 
in the amount of coverage influence how fast and to what ex- 
tent beliefs and expectations change. The large volume and 
prominent display of stories on the backdating of stock op- 
tions in recent months is one example of how the media can 
help set the agenda. The sharp drop in stories about insur- 
ance brokers’ getting incentive payments from underwriters 
illustrates how the media can help relegate a hot topic to the 
back burner. 
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Reputation and Its Risks 


A Framework for Managing Reputational Risk 


Understanding the factors that determine reputational risk enables a 
company to take actions to address them. 



Put one person in charge. Assessing reputation, evaluating 
reality, identifying and closing gaps, and monitoring chang- 
ing beliefs and expectations will not happen automatically. 
The CEO has to give one person responsibility for making 
these things happen. Obvious candidates are the COO, the 
CFO, and the heads of risk management, strategic planning, 
and internal audit. They have the credibility and control 
some of the resources necessary to do the job. In general, 
those whose existing responsibilities pose potential conflicts 
probably shouldn’t be chosen. People holding top “spin” jobs, 
such as the heads of marketing and corporate communica- 
tions, fall into this category. So does the general counsel, 
whose job of defending the company means his relationship 
with stakeholders is often adversarial and whose typical re- 
sponse to media inquiries is “no comment.” 

The chosen executive should periodically report to top 
management and the board on what the key reputational 
risks are and how they are being managed. It is up to the 
CEO or the board to decide whether the risks are acceptable 
and, if not, what actions should be taken. In addition, top man- 
agement and the board should periodically review the risk- 
management process and make suggestions for improving it. 

Managing reputational risk isn’t an extraordinarily expen- 
sive undertaking that will require years to implement. At 


most well-managed companies, many of the elements are al- 
ready in place in disparate parts of the organization. The ad- 
ditional costs of installing and using the new tools described 
above to identify risks and design responses are in the low to 
high six figures, depending on the size and complexity of the 
company. This is a modest expense compared with the value 
at stake for many companies. 

So the primary challenge is focus: recognizing that repu- 
tational risk is a distinct category of risk and giving one per- 
son unambiguous responsibility for managing it. This person 
can then identify all the parts of the organization whose ac- 
tivities can affect or pose risks to its overall reputation and 
enhance the coordination among its functions and units. The 
improvements in decision making will undoubtedly result in 
a better-run company overall. 

Senior executives tend to be optimists and cheerleaders. 
Their natural inclination is to believe the praise heaped on 
their companies and to discount the criticism. But looking at 
the world and one’s organization through rose-tinted glasses 
is an abdication of responsibility. Being tough-minded about 
both will enable a company to build a strong reputation that 
it deserves. 9 


Reprint R0702F 
To order, see page 158. 


114 Harvard Business Review I February 2007 I hbr.org 









Harvard Business Review and Harvard Business School Publishing content on EBSCOhost is licensed 
for the individual use of authorized EBSCOhost patrons at this institution and is not intended for 
use as assigned course material. Harvard Business School Publishing is pleased to grant permission 
to make this work available through "electronic reserves" or other means of digital access or 
transmission to students enrolled in a course. For rates and authorization regarding such course 
usage, contact permissions@hbsp.harvard.edu 



